Slowed login for domain accounts after encrypting drive

[jezerski]

Hello. Has anyone seen issues with domain joined accounts taking a long time to login after encrypting the hard drive? I have some Sierra and High Sierra machines, and the login time has increased by over a minute for domain joined accounts. Local accounts don't seem to be affected. The time from boot to the login screen has remained about the same, but once the password is entered, a status bar pops up under the password field, and it takes about an additional 75 seconds to log in compared to pre-encryption. We've been tasked with rolling this out company wide, but this is a noticeable difference and will generate complaints I'm sure! We're leveraging Sophos to enable the encryption process, but I've tried this on a freshly imaged Mac with no JAMF, Sophos, or any additional software, I put a fresh copy of Sierra on, joined it to the domain, and encrypted it, and this alone added about 40 seconds to the login time for domain accounts. Any thoughts or suggestions would be appreciated.

Thanks
Jason

[jdye]

This happened to all of our Sierra machines as well.

[sdagley]

@jezerski Keep in mind that with FileVault 2 enabled the first prompt is coming from booting into the recovery/file vault boot partition. Once you enter your password there the Mac boots from the now-unlocked normal OS partition.

[jezerski]

@jdye and @sdagley thanks for the responses. Did you notice any issue with local accounts as well, or are those still working quickly? Our local admin account still logs into the machine in 5-10 seconds, so it appears to only affect domain joined accounts.

[sdagley]

@jezerski Are these wired or wireless Macs? It could be that the delay you're seeing is for the Mac to bring up a network connection (since they aren't on the network at the FV2 log in screen) and establish communication with your domain controller.

[jezerski]

@sdagley this happens when hardwired to our network, or off-network.

[dgreening]

Try adjusting the dsbindtimeout down to 20 seconds. I do this via config profile with the following custom setting: